How do I run a pcap on Azure Firewall?

Question

I am trying to build a non Meraki VPN tunnel to a Meraki vMX appliance that sits behind an Azure Firewall. I suspect that I am missing a Network or DNAT rule to allow interresting traffic. I need visibility on the traffic flow to understand why traffic is not making it to the vMX appliance.

Is there an option for me to run a debug directly on the Azure Firewall?

Answer 1

Hi Kryptic Dwarf,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
 

Azure Firewall does not support direct packet capture (pcap) or debugging directly on the firewall itself.  Azure Firewall provides diagnostic logs that can help you understand traffic flow and identify any issues.  
Steps to Enable Diagnostic Logging:

1. Navigate to the Azure Firewall resource in the Azure portal.
2. Select "Diagnostics settings" under the Monitoring section.
3. Click on "Add diagnostic setting".
4. Select the log categories you want to enable (Application Rule Log, Network Rule Log, etc.).
5. Choose where to send the logs (Log Analytics workspace, Storage Account, or Event Hub).

Refer this link : Monitor Azure Firewall | Microsoft Learn

Thanks,

Rohith

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.